Attacking DDoS at the source

Distributed denial-of-service (DDoS) attacks present an Internet-wide threat. We propose D-WARD, a DDoS de-fense system deployed at source-end networks that au-tonomously detects and stops attacks originating from these networks. Attacks are detected by the constant monitoring of two-way traffic flows between the network and the rest of the Internet and periodic comparison with normal flow models. Mismatching flows are rate-limited in proportion to their aggressiveness. D-WARD offers good service to le-gitimate traffic even during an attack, while effectively re-ducing DDoS traffic to a negligible level. A prototype of the system has been built in a Linux router. We show its effec-tiveness in various attack scenarios, discuss motivations for deployment, and describe associated costs. 1